package org.chipu.jnids.alert;

import java.net.UnknownHostException;
import java.text.ParseException;
import java.text.SimpleDateFormat;
import java.util.Date;
import java.util.Locale;
import org.chipu.shared.util.singletons.Utils;

class PrimaryDetectionEngine implements SnortComponentGenerator {
	@Override
	public SnortEvent parseSyslogLine(String line) throws ParseException, UnknownHostException {
		line = line.replaceAll("  ", " ");
		String[] ss = line.split(" ");
		SimpleDateFormat sdf = new SimpleDateFormat("MMM dd HH:mm:ss", Locale.US);
		Date d = sdf.parse(ss[0] + " " + ss[1] + " " + ss[2]);
		String sensor = ss[3];
		String app = ss[4].substring(0, ss[4].length() - 1);
		if (!app.equals("snort"))
			throw new ParseException("Not a snort event: " + line, (ss[0] + " " + ss[1] + " " + ss[2] + " " + ss[3]).length() + 1);
		String sid = ss[5];

		byte priority = 0;
		int priorityIndex = line.indexOf("[Priority:");
		if (priorityIndex != -1)
			priority = Byte.parseByte(line.substring(priorityIndex + 11, line.indexOf("]", priorityIndex)));

		String classification = null;
		int classificationIndex = line.indexOf("[Classification:");
		if (classificationIndex != -1)
			classification = line.substring(classificationIndex + 17, line.indexOf("]", classificationIndex));

		// String protocol = ss[ss.length - 4].substring(1, ss[ss.length -
		// 4].length() - 1);//
		// TCP|PROTO:255
		String protocol = "";// TCP|PROTO:255
		int protocolIndex = line.indexOf("{");
		if (protocolIndex != -1)
			protocol = line.substring(protocolIndex + 1, line.indexOf("}", protocolIndex));

		int startDescriptionIndex = line.indexOf(sid) + sid.length();
		int endDescriptionIndex = Utils.minPositive(classificationIndex, priorityIndex, protocolIndex);
		// System.out.println(startDescriptionIndex + " " +
		// endDescriptionIndex+" "+classificationIndex+" "+priorityIndex+"
		// "+protocolIndex);
		String description = line.substring(startDescriptionIndex, endDescriptionIndex).trim();

		// if (description.startsWith("(portscan) ") && classification == null)
		// {
		// description = description.substring(11);
		// classification = "portscan";
		// }

		String origAddress = ss[ss.length - 3];
		String origIp = origAddress.indexOf(':') == -1? origAddress: origAddress.split(":")[0];
		int origPort = origAddress.indexOf(':') == -1? 0: Integer.parseInt(origAddress.split(":")[1]);
		String destAddress = ss[ss.length - 1];
		String destIp = destAddress.indexOf(':') == -1? destAddress: destAddress.split(":")[0];
		int destPort = destAddress.indexOf(':') == -1? 0: Integer.parseInt(destAddress.split(":")[1]);
		return new SnortEvent(d, sensor, sid, description, classification, priority, protocol, origIp, origPort, destIp, destPort);
	}

	@Override
	public String toString(SnortEvent ev) {
		String date = new SimpleDateFormat("MMM d HH:mm:ss", Locale.US).format(ev.date);
		if (date.split(" ")[1].length() == 1)
			date = date.substring(0, 3) + " " + date.substring(3);
		return date + " " + ev.sensor + " snort: " + ev.sid + " " + ev.description
			+ (ev.classification == null? "": " [Classification: " + ev.classification + "]")
			+ (ev.priority == 0? "": " [Priority: " + ev.priority + "]:") + " {" + ev.alt_protocol + "} "
			+ ev.origIp.getHostAddress() + ((ev.origPort == 0)? "": ":" + ev.origPort) + " -> " + ev.destIp.getHostAddress()
			+ ((ev.destPort == 0)? "": ":" + ev.destPort);
	}

	@Deprecated
	private static SnortEvent parseSyslogLineByPosition(String line) throws ParseException, UnknownHostException {
		String[] ss = line.split(" ");
		SimpleDateFormat sdf = new SimpleDateFormat("MMM dd HH:mm:ss", Locale.US);
		Date d = sdf.parse(ss[0] + " " + ss[1] + " " + ss[2]);
		String sensor = ss[3];
		String app = ss[4].substring(0, ss[4].length() - 1);
		if (!app.equals("snort"))
			throw new ParseException("Not a snort event: " + line, (ss[0] + " " + ss[1] + " " + ss[2] + " " + ss[3]).length() + 1);
		String sid = ss[5];
		StringBuilder description_ = new StringBuilder();
		for(int i = 6; i < ss.length - 5; i++)
			description_.append(ss[ss.length - i]).append(" ");
		String description = description_.substring(description_.length() - 11).equals("[Priority: ")? description_.substring(0,
			description_.length() - 11): description_.substring(0, description_.length() - 1);
		byte priority = Byte.parseByte(ss[ss.length - 5].substring(0, ss[ss.length - 5].length() - 2));
		String protocol = ss[ss.length - 4].substring(1, ss[ss.length - 4].length() - 1);// TCP|PROTO:255
		String origAddress = ss[ss.length - 3];
		String origIp = origAddress.indexOf(':') == -1? origAddress: origAddress.split(":")[0];
		int origPort = origAddress.indexOf(':') == -1? 0: Integer.parseInt(origAddress.split(":")[1]);
		String destAddress = ss[ss.length - 1];
		String destIp = destAddress.indexOf(':') == -1? destAddress: destAddress.split(":")[0];
		int destPort = destAddress.indexOf(':') == -1? 0: Integer.parseInt(destAddress.split(":")[1]);
		return new SnortEvent(d, sensor, sid, description, "", priority, protocol, origIp, origPort, destIp, destPort);
	}
}